Creating Reports

[RSAAdmin]

I am trying to clean up my reports in Security Analytics to make a little easier to read. I have searched the forums and documentation multiple times but cannot find an answer to my question. So, is it possible to change the display text of the column, or field being queried?

So, an example is:

Select ip.src

where service=filename exists

Current Results:

Column Name:    Source IP Address

Results:               192.168.15.1

                           192.168.15.2

For example, in SQL I would write a query like this to acheive my desired results:

Select ip.src as 'Internal IP'

from xxxx

where service=filename exists

The results would be displayed as:

Column Name:     Internal IP

Results:               192.168.15.1

                           192.168.15.2

  Thanks in advance!

[RSAAdmin · Accepted solution]

Alias for column name currently is not supported when you report on SA Core but is supported for Warehouse Reports. For SA Core there is a request to support alias and currently it is planned for future release i.e., 10.6.1.

[RSAAdmin]

Thanks for the info! Its nice to get a solid answer.